Legal
Security
Reporting a vulnerability
If you find a security issue, please report it through GitHub's private advisory flow at github.com/levimackay/perqora/security rather than a public issue. Details on scope and response process are in this repository's SECURITY.md. Please practice responsible disclosure: give the project a reasonable window to fix the issue before sharing it publicly.
The codebase is public
Perqora is open source. Every route, query, and validation rule in this app is auditable, nothing security-relevant is hidden behind a closed-source layer. That cuts both ways: it also means anyone can read exactly how access control works, which is why the details below are stated plainly rather than left vague.
No client-side secrets
No API keys, tokens, or credentials are ever shipped to the browser. Anything that needs a secret (database access, admin gating) stays server-side.
Admin access
The admin area is gated by a single shared bearer token, checked at the proxy layer before any admin route or admin action runs. There are no per-maintainer accounts and no role-based access control. That is a deliberate v1 simplification appropriate for a single-maintainer, volunteer-run project, not an enterprise access model. If Perqora grows more maintainers, that is the first access-control change on the list.
No third-party trackers
There are no ad pixels, third-party analytics scripts, or embedded trackers on this site. See privacy for what limited, anonymous analytics is collected in-house.